fc53f460909a9bd07b80700aaac47ac5664400539a31b0b98ebc537b62da5107

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81cbe40232754737c53953d227e5888f_JaffaCakes118.pdf
Size

9KB
MD5

81cbe40232754737c53953d227e5888f
SHA1

f9d3df15057255e4ae5a3eb0ef44dcd1c8ee2ad0
SHA256

fc53f460909a9bd07b80700aaac47ac5664400539a31b0b98ebc537b62da5107
SHA512

37f6828063161a0c65536620b48ced7cdde1ab88c94ed31fe55a77455a6dfe24405af27b32a431bc015f16456b978237198857dbd1ff476e8144553056e710e8
SSDEEP

192:jPz4ULMxLIKXHsfyx5ZBYqPzylQqgO7r/c8PBO+rtIHhK8rz+9u/ILWMRI/mkCi:jPz4ULMxLIKXHsfC6q+lQM7r/cyMcIHp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2068	AcroRd32.exe
2068	AcroRd32.exe
2068	AcroRd32.exe
2068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\81cbe40232754737c53953d227e5888f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
90fc1303c4f12532070dd2925b1faa9b

SHA1
9161185a40ca3bd4f9bb64548f39fbce2740c00d

SHA256
b0080016cea4f5842e429f5b5d499b5b7f33aa4cbdce87bd3ddd0131841ba085

SHA512
93e3e3d933d6b83aa8a26f9fab76fc469487ee9fff6eb3a79e381fda41f606bfcd22a7383a627bdbf343dff35d2f3760fda49547e50f37c9f20ca8ac65d56fa8

Download Submit
memory/2068-0-0x0000000002F70000-0x0000000002FE6000-memory.dmp

Filesize
472KB

Download